← Back to Feed

Anjvision YSSD-RTMP-H5

CVE-2026-100291CVE-2026-100292CVE-2026-100293CVE-2026-100294CVE-2026-100295CVE-2026-100296CVE-2026-100297CVE-2026-100298CVE-2026-100299

September 29, 2026 · CISA (US-CERT) · Severity: CRITICAL

This advisory details multiple critical vulnerabilities in Anjvision YSSD-RTMP-H5 camera firmware, including insecure defaults, command injection, and weak credentials. Collectively, these flaws allow an attacker to completely compromise the device. CISA has been unable to coordinate with the vendor, and no patch is available. 📌 **Analyst Note:** With no fix available and a CVSS of 9.8, these cameras are effectively a ticking bomb for any network they are connected to. Organizations should immediately disconnect affected devices until they can be replaced or at least segmented behind strict firewalls.

Key Takeaways

  • The Anjvision YSSD-RTMP-H5 camera firmware contains nine separate vulnerabilities, including unauthenticated service endpoints, OS command injection, and hardcoded credentials.
  • Attackers can exploit these flaws to achieve full device takeover, access sensitive information, and execute arbitrary operating system commands with high privileges.
  • The vendor has not responded to CISA, and no fix is planned, leaving all devices running firmware version 3.3.2.4_build_2024-12-26 permanently vulnerable.
☕ Buy a Coffee